1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-3040

[JENKINS:SECURITY-3040] Shared projects are unconditionally discovered by `gitlab-branch-source`

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

GitLab allows sharing a project with another group.

gitlab-branch-source 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group.

This allows attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins after the next scan of the group's projects.

In gitlab-branch-source 688.v5fa_356ee8520, the default strategy for discovering projects does not discover projects shared with the configured owner group.
To discover projects shared with the configured owner group, use the new trait "Discover shared projects".

NOTE: After updating, any shared project that has already been discovered will be removed unless the new trait is added to the organization folder configuration before running a scan.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/gitlab-branch-source <= 684.vea_fa_7c1e2fe3
pkg:github/jenkinsci/gitlab-branch-source-plugin <= 684.vea_fa_7c1e2fe3
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/gitlab-branch-source = 688.v5fa_356ee8520
pkg:github/jenkinsci/gitlab-branch-source-plugin = 688.v5fa_356ee8520
ID
JENKINS:SECURITY-3040
Severity
medium
Published
2024-01-24T00:00:00
(7 months ago)
Modified
2024-01-24T00:00:00
(7 months ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository gitlab-branch-source repository https://github.com/jenkinsci/gitlab-branch-source-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/gitlab-branch-source org.jenkins-ci.plugins gitlab-branch-source <= 684.vea_fa_7c1e2fe3
Fixed pkg:maven/org.jenkins-ci.plugins/gitlab-branch-source org.jenkins-ci.plugins gitlab-branch-source = 688.v5fa_356ee8520
Affected pkg:github/jenkinsci/gitlab-branch-source-plugin jenkinsci gitlab-branch-source-plugin <= 684.vea_fa_7c1e2fe3
Fixed pkg:github/jenkinsci/gitlab-branch-source-plugin jenkinsci gitlab-branch-source-plugin = 688.v5fa_356ee8520
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date